CVE-2025-23039

Published: Jan 17, 2025Modified: Jun 17, 2026Deferred

5.2

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.5 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://github.com/caido/caido/security/advisories/GHSA-3mfw-fhfp-mgrv

Source: security-advisories@github.com

Timeline

No history available yet.